sunbelt personal firewall 4

Greetings! Has anyone taken the opportunity to download the latest version of SPF 4? Any opinions on it's performance? Sincerely...Securon

 

I know it's not strictly related to the firewall capablities but this product doesn't uninstall (folders,services ware there and running)/At least this is what happened on my xp pro 32 bit setup.It happened twice so i guess it's better to have an image program in case you want to get rid of it.
I disabled the HIPS and web component from the start and the firewall didn't get me any troubles.No slow downs ,start-up time was unaffected,no CPU trouble with p2p .I already have many products this will be on my wait list also.
For more detailed impressions maybe some of the experts will join and test.

 

Hi,

From which perspective? Could you be more specific?


- Stem

 

An imaging program is always a great idea, but Sunbelt does have an uninstaller for their firewall: (http://support.sunbeltsoftware.com/Default.aspx?answerid=1778) I've used it, it's fairly thorough.

 

In response to Stem, maybe I'm imagining it but it seems to be quicker and more responsive than the previous version! Sincerely...Securon

 

My opinions based on use with XP-Home-SP3, SSM, PG2, NOD32v3, Sunbelt (Kerio) FW v4.6.1861:

Nice interface, has user defined IP groups and a GUI very similar to Kerio. Very good at fast user switching. Can work with or without packet rules. If without packet rules, the interface resembles sections of ZA.
Lightening fast. Eight months of use - no crashes, no BSODs, good logging. It works well for me. Rules are obeyed as far as I can tell from watching the router logs and a packet sniffer but I'm no expert on the really hard details.

If free version then after 30 days, when web watch and HIPS disactivate, it nags to buy. Also nags on every bootup and every attempt to click on disabled features. Disabled features load in anyway and take up space. Very annoying.

Paid version calls home to, probably, update (? I don't see anything updating) and likely to verify a licence of the paid version. It's all in the logs. Nothing is hidden and this activity is described in the user guide. User guide is exceptionally well done IMO but there are no instructions how to prevent some features from installing in the first place.

 

I can confirm that as well. One thing the cleaner leaves behind in registry someplace I don't recall where is the sbhips module. No big deal, it's not doing anything.

 

Hi,

I really wanted to try it but it constantly ate cpu. Unless thats because I was using one of the adblock/cookie features. I will send a dmp file if need be. I liked the idea of trying the snort rules an the price.

 

I don't like the 'call home' part.

Is this customary for paid-for standalone firewalls ?

 

This call home seems inocuous to me really. To wit:
From the log:
[04/May/2009 14:50:42] RegistrationManager.cpp: RegistrationManager::CheckLicenseHelper: POST Data: key=[MY KEY LISTED HERE]
[04/May/2009 14:50:42] Downloader.cpp: URL: http://www.sunbeltsoftware.com:80/keys/440/check_license.cfm?key=[MY KEY LISTED HERE]

Packet sniffer indicates it sends nothing but the key, and OK packet returns with the expiration date.
Once the paid or the 30-day free licence expires, the nags begin.

I think many firewalls do check the licence expiration by verifying on their servers.

 

The only known issue with the firewall using a lot of CPU would occur if you have a lot of connections opening on the system. Something like P2P file sharing could cause this. To resolve that issue you can disable the "Resolve address" option. To do that, open the firewall. Click Overview on the left and make sure you're on the connections tab. Right click anywhere on the white part of the screen then uncheck the "Resolve address" option. This should stop any problems with CPU usage.

You're correct. The only reason the firewall should call home is to either check for updates or to verify the license is still valid.

 

If a firewall/suite has updates for such as an included malware scanner or similar regular update, then a license will be checked during the update.
With sunbelt, it is (as far as I can see) simply a check on the license due to this being a subscription.

I dont really like security software that works in this manner. I can understand any update being stopped after the license expires, but for a firewall to lose various functions such as the Hips is not, IMHO very good.


- Stem

 

It's indeed somewhat off that the firewall will be completely or partially disabled after after a license check (done correctly or incorrectly) disables functionality.

On the other hand, I gave this one a quick trial (not in 'learning mode', Windows XP), and it's definitely faster than the previous version.

 

In the free mode, it also checks if the licence is there. Because I suppose that's what makes the disabling of several funtions.

I have not problem with it because I've learned in this forum and others that a standalone HIPS is a stronger thing, so I use SSM. If I go free Sunbelt, my only wish would be to have the HIPS section not even load and occupy memory and resources. Likewise the webwatch which I can control in Opera.
As far as do we like security software that disables functions - well, something needs to make a disctinction between paid and free. Just look at the recent, wonderful, Outpost free, with the log viewer disabled. Ouch!

 

If you wanted to run the firewall without loading HIPS at all you can run this file to completely disable it:

http://www.sunbelt-software.com/support/SPF/spfhips.exe

You can run this file to enable it again if you wish:

http://www.sunbelt-software.com/support/SPF/spfhipsenable.exe